Topic starter
10/07/2026 9:14 pm
TL;DR: At RSAC 2026, cybersecurity keeps adding tools and activity without improving outcomes, because teams still measure progress by compliance and alert volume rather than reduced blast radius or containment, according to Illumio. The practical shift is to treat breaches as inevitable and optimise for limiting spread, not pretending prevention alone will solve the problem.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “Cybersecurity Is Broken: Why Outcomes Aren't Improving and What Needs to Change”.
Key questions
Q: Where does cybersecurity fail when organisations keep adding controls but not containment?
A: It fails when control activity is mistaken for reduced exposure.
Q: How should security teams govern privileged access in cloud and hybrid environments?
A: Teams should govern privileged access around runtime authorization, not just connectivity or login.
Q: What are the signs that containment is failing in practice?
A: Containment is failing when teams cannot quickly isolate a host, revoke a risky path, or explain how far an identity can move laterally.
Practitioner guidance
- Measure blast radius directly Add containment-oriented KPIs such as reachable critical assets, allowed east-west paths, and identities with cross-zone access.
- Segment critical systems by consequence Group the assets that would create the largest operational or regulatory impact if reached, then isolate them with tighter communication rules and stricter identity boundaries.
- Reduce standing identity reach Review human and non-human identities for unnecessary reach into adjacent systems, especially service accounts, tokens, and delegated permissions that could expand an initial foothold.
Bottom line: Cybersecurity programmes can look mature while still allowing an intrusion to spread quickly across trusted environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:37 pm
Containment is now the decisive control variable: organisations can keep adding preventive tooling without changing breach outcomes if the post-entry environment remains too open. The article is right to shift the conversation from “did we stop the attack?” to “how far could it go?” That is a governance change as much as a technical one, and it puts segmentation, identity scope, and runtime isolation at the centre of the security model.
A question worth separating out:
Q: Should organisations prioritise prevention or containment first?
A: They should do both, but containment usually deserves priority in environments where some compromise is inevitable. Prevention reduces entry opportunities, yet containment determines whether an incident stays small or becomes expensive. If you can only improve one area quickly, reduce reachable assets and privilege scope first.
👉 Read our full editorial: Cybersecurity outcomes are stalling because containment is missing